What does the internal log say for the hosts that work?
Maybe you could check for the hosts who are missing on the internal logs. Would be nice to see what the index="_internal" says.
Also it might help to have an outputs.conf to send the data directly to the indexer.
... View more